CVE-2022-24836

HIGH
Published Apr 11, 20224y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Apr 11, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-1333
CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 7

VendorProductVersionRange
nokogirinokogiri* <1.13.4
fedoraprojectfedora34any
fedoraprojectfedora35any
fedoraprojectfedora36any
debiandebian_linux9.0any
debiandebian_linux10.0any
applemacos*≥13.0  –  <13.1

References 11

  • seclists.org http://seclists.org/fulldisclosure/2022/Dec/23
    Mailing ListThird Party Advisory
  • github.com https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd
    PatchThird Party Advisory
  • github.com https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/05/msg00013.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/10/msg00018.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00010.html
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DHCOWMA5PQTIQIMDENA7R2Y5BDYAIYM/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUPLBUZVM4WPFSXBEP2JS3R6LMKRTLFC/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDCWRQXJQ3TFSETPCEFMQ6RR6ME5UA3/
  • security.gentoo.org https://security.gentoo.org/glsa/202208-29
    Third Party Advisory
  • support.apple.com https://support.apple.com/kb/HT213532
    Third Party Advisory

Remediation

  • github.com https://github.com/sparklemotion/nokogiri/commit/e444525ef1634b675cd1cf52d39f4320ef0aecfd
    PatchThird Party Advisory